{"id":"CVE-2024-55069","aliases":["DEBIAN-CVE-2024-55069","EUVD-2025-14312","GHSA-v2gm-5jqw-x4qc","JLSEC-2025-152","UBUNTU-CVE-2024-55069"],"status":"published","title":"ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat...","description":"ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00308,"percentile":0.23833,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2025-05-02T00:00:00Z","modified":"2026-11-06T10:46:25Z","fixes":[{"ecosystem":"Debian:13","package":"ffmpeg","fixed_in":["7:7.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ffmpeg","fixed_in":["7:7.1.1-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"FFMPEG_jll","fixed_in":["7.1.1+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"FFplay_jll","fixed_in":["7.1.1+0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:7.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:7.1.1-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"FFMPEG_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"7.1.0+0"},{"fixed":"7.1.1+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"FFplay_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"7.1.0+0"},{"fixed":"7.1.1+0"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6:0.8.7-1ubuntu2","6:9.10-1ubuntu1","6:9.10-1ubuntu2","6:9.10-1ubuntu5","6:9.10-1ubuntu6","6:9.10-1ubuntu7","6:9.11-2ubuntu1","6:9.11-2ubuntu2","6:9.13-0ubuntu0.14.04.1","6:9.14-0ubuntu0.14.04.1","6:9.16-0ubuntu0.14.04.1","6:9.18-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1+esm1"]}],"products":[{"vendor":"ffmpeg","product":"ffmpeg"}],"references":[{"url":"https://trac.ffmpeg.org/ticket/11326","tags":["Exploit","Issue Tracking","web","report"]},{"url":"https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/4cc1495aca45445181a107a682c32cfe31459929","tags":["Patch","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55069","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v2gm-5jqw-x4qc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55069.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-55069","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-55069","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-55069","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-55069","description":"ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c.","status":"published","published":"2025-05-02T00:00:00Z","modified":"2025-05-12T14:08:54.678Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:34:22.525279Z"}],"euvd":[{"id":"EUVD-2025-14312","description":"ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c.","status":"published","published":"2025-05-02T00:00:00Z","modified":"2025-05-12T14:08:54Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:49.812342Z"}],"ghsa":[{"id":"GHSA-v2gm-5jqw-x4qc","title":"ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat...","description":"ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c.","status":"published","published":"2025-05-03T00:30:32Z","modified":"2025-05-12T15:31:41Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:02:14.203214Z"}],"nvd":[{"id":"CVE-2024-55069","description":"ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c.","status":"published","published":"2025-05-02T22:15:16.75Z","modified":"2026-06-17T08:10:56.7Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:10:46.40251Z"}],"osv":[{"id":"CVE-2024-55069","description":"ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c.","status":"published","published":"2025-05-02T00:00:00Z","modified":"2026-11-07T13:28:00.114297291Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-07T11:15:38.581573Z"},{"id":"DEBIAN-CVE-2024-55069","description":"ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c.","status":"published","published":"2025-05-02T22:15:16.75Z","modified":"2026-11-02T12:03:02.567600824Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:44.429177Z"},{"id":"JLSEC-2025-152","title":"ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function `iamf_read_header` in...","description":"ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function `iamf_read_header` in `/libavformat/iamfdec.c`.","status":"published","published":"2025-10-19T19:08:53.76Z","modified":"2026-07-23T22:30:11.01007017Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"UBUNTU-CVE-2024-55069","description":"ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c.","status":"published","published":"2025-05-02T22:15:00Z","modified":"2026-04-22T15:21:45.864699Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:15.331356Z"}]}}